Embedding WON in large IAN Switches

A remote network monitoring management agent monitors all traffic on a network segment. In a switched LAN, the only device where all traffic can be seen is the LAN switch. Thus, the most appropriate place to insert an RMON probe is in the LAN switch. In this article issues in implementing various RMON groups in a IAN switch are studied, and some approaches are proposed. The centralized solution turns out to be impractical because it is rohibitively expensive. A distributed A simple analytical model is used to compare the alternatives. We investigate empirically the cost of performing typical filtering operations in an operational network. This shows that reverse filtering is often much more computationally efficient than forward filtering. We show that the distributed design can provide full RMON capability on all ports simultaneously at affordable cost. design is presented that is suitable for imp P ementation on multiprocessor switches.